The @catamania/front-components npm package version 1.0.5 includes a postinstall.js script that runs automatically upon npm install. This script collects system information including os.hostname(), os.userInfo().username, process.cwd(), and the names of environment variables from process.env. It then sends this data as a JSON payload via HTTPS POST to a hardcoded webhook.site URL. The main index.js exports a trivial Vue button component unrelated to the malicious behavior, consistent with a scoped dependency-confusion or reconnaissance probe designed to identify internal build hosts resolving the @catamania scope to the public registry.

The malicious postinstall script leaks host reconnaissance data to an external attacker-controlled endpoint. Although environment variable values are masked, the exposure of host identifiers and environment variable names can aid attackers in profiling the environment for further attacks or supply chain compromise. There is no indication of direct code execution beyond data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.5 of @catamania/front-components. Investigate alternative trusted sources or versions of the package. Monitor for updates from the package maintainers or npm advisories for remediation. Consider auditing postinstall scripts in dependencies before installation.